SAA-C03 Question 435
Single answerAn e-commerce company is hosting its web application on Amazon EC2 instances and stores product images in an Amazon S3 bucket. The company wants to ensure that the images are only accessible through the web application and not directly via the S3 bucket URL. How can you achieve this requirement?
- A
Use an S3 bucket policy to allow access only from the web application's public IP address.
- B
Enable server-side encryption on the S3 bucket to restrict direct access.
- C
Use an S3 bucket policy that denies all public access and allows access only through an Amazon CloudFront origin access control.
- D
Configure Amazon S3 Transfer Acceleration to restrict direct access to the S3 bucket.
Show answer and explanation
Correct answer: C
Explanation
To restrict direct access to an S3 bucket while still allowing access through a web application, you can use Amazon CloudFront with an origin access control (OAC) or origin access identity (OAI). This setup ensures that the S3 bucket is only accessible through CloudFront, and direct access to the bucket URL is denied using an S3 bucket policy. This method is secure and follows best practices for content delivery in AWS.
- A. Incorrect.
Using an S3 bucket policy to allow access from the web application's public IP address is not a scalable solution, especially if the web application operates behind a load balancer or has multiple instances with changing IPs.
- B. Incorrect.
Enabling server-side encryption is for securing data at rest and does not control access to the bucket URL.
- C. Correct.
An S3 bucket policy that denies all public access and allows access only through an Amazon CloudFront origin access control ensures that the S3 bucket is accessible only through CloudFront. This prevents direct access to the bucket URL.
- D. Incorrect.
Amazon S3 Transfer Acceleration improves upload and download performance but does not provide access restriction mechanisms.